Authentication

A calendar app wants to read your Google Calendar. It should never see your Google password, not even once to throw it away. OAuth 2.0 is the protocol that makes that possible: your Google account issues the calendar app a token that lets it read your calendar and nothing else, and the app never touches your credentials. That’s delegated authorization, and it’s a different problem from authentication. JWT vs session authentication covers how a server decides who you are. OAuth answers a narrower question: can this other application act on your behalf, and for what. Most OAuth mistakes start when people mix the two up. ...

Log a user out of a session-based app and the server forgets them on the next request. Log them out of a JWT-based app and, unless you built extra machinery for it, the token they’re holding stays valid until it expires. That difference is the real decision behind “JWT vs session”. The rest follows from it. What a session actually stores A session keeps the user’s state on the server and hands the browser only a lookup key. ...